CVE-2025-13533: CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields
The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, and Advanced assignment data. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the CJT block edit screen in the admin dashboard.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated with Administrator-level access or higher in WordPress. The attack complexity is rated high, and no user interaction is required for the attacker to store the payload.
When does the stored script execute?
The injected script executes when a user accesses the CJT block edit screen in the WordPress admin dashboard. The vulnerable input locations include Assignment Engine Expressions, URLs, and Advanced assignment data fields.
Which installations are affected?
All CSS & JavaScript Toolbox versions up to and including 12.0.6 are affected. The available data does not identify a fixed version.